CVE-2019-12387
Published: 10 June 2019
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
Priority
Low
CVSS 3 base score: 6.1
Status
| Package | Release | Status |
|---|---|---|
|
twisted Launchpad, Ubuntu, Debian |
bionic |
Released
(17.9.0-2ubuntu0.1)
|
| cosmic |
Ignored
(reached end-of-life)
|
|
| disco |
Ignored
(reached end-of-life)
|
|
| eoan |
Released
(18.9.0-3ubuntu1.1)
|
|
| precise |
Not vulnerable
(code not present)
|
|
| trusty |
Released
(13.2.0-1ubuntu1.2+esm1)
|
|
| upstream |
Needs triage
|
|
| xenial |
Released
(16.0.0-1ubuntu0.4)
|
|
|
Patches: upstream: https://github.com/twisted/twisted/commit/6c61fc4503ae39ab8ecee52d10f10ee2c371d7e2 |
||
|
twisted-py3 Launchpad, Ubuntu, Debian |
bionic |
Does not exist
|
| cosmic |
Does not exist
|
|
| disco |
Does not exist
|
|
| eoan |
Does not exist
|
|
| precise |
Does not exist
|
|
| trusty |
Does not exist
|
|
| upstream |
Needs triage
|
|
| xenial |
Does not exist
|
|
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12387
- https://labs.twistedmatrix.com/2019/06/twisted-1921-released.html
- https://twistedmatrix.com/pipermail/twisted-python/2019-June/032352.html
- https://ubuntu.com/security/notices/USN-4308-1
- https://ubuntu.com/security/notices/USN-4308-2
- NVD
- Launchpad
- Debian